mirrors/buildroot
0
0
Fork 0
mirror of https://git.busybox.net/buildroot.git synced 2024-11-23 05:23:39 +08:00
Code Issues Packages Projects Releases Wiki Activity

stack protector: moved option out of adv menu

Browse Source 
Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Matt Weber 2018-01-23 22:09:40 -06:00 committed by Peter Korsgaard
parent 5e7e27a3a7
commit d3732cf4a2
1 changed files with 57 additions and 55 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

112
Config.in
View File

@ -567,61 +567,6 @@ config BR2_GOOGLE_BREAKPAD_INCLUDE_FILES
endif
choice
bool "build code with Stack Smashing Protection"
default BR2_SSP_ALL if BR2_ENABLE_SSP # legacy
depends on BR2_TOOLCHAIN_HAS_SSP
help
Enable stack smashing protection support using GCC's
-fstack-protector option family.
See
http://www.linuxfromscratch.org/hints/downloads/files/ssp.txt
for details.
Note that this requires the toolchain to have SSP support.
This is always the case for glibc and eglibc toolchain, but is
optional in uClibc toolchains.
config BR2_SSP_NONE
bool "None"
help
Disable stack-smashing protection.
config BR2_SSP_REGULAR
bool "-fstack-protector"
help
Emit extra code to check for buffer overflows, such as stack
smashing attacks. This is done by adding a guard variable to
functions with vulnerable objects. This includes functions
that call alloca, and functions with buffers larger than 8
bytes. The guards are initialized when a function is entered
and then checked when the function exits. If a guard check
fails, an error message is printed and the program exits.
config BR2_SSP_STRONG
bool "-fstack-protector-strong"
depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_9
help
Like -fstack-protector but includes additional functions to be
protected - those that have local array definitions, or have
references to local frame addresses.
comment "Stack Smashing Protection strong needs a toolchain w/ gcc >= 4.9"
depends on !BR2_TOOLCHAIN_GCC_AT_LEAST_4_9
config BR2_SSP_ALL
bool "-fstack-protector-all"
help
Like -fstack-protector except that all functions are
protected. This option might have a significant performance
impact on the compiled binaries.
endchoice
comment "Stack Smashing Protection needs a toolchain w/ SSP"
depends on !BR2_TOOLCHAIN_HAS_SSP
choice
bool "libraries"
default BR2_SHARED_LIBS if BR2_BINFMT_SUPPORTS_SHARED
@ -732,6 +677,63 @@ config BR2_REPRODUCIBLE
endmenu
comment "Security Hardening Options"
choice
bool "Stack Smashing Protection"
default BR2_SSP_ALL if BR2_ENABLE_SSP # legacy
depends on BR2_TOOLCHAIN_HAS_SSP
help
Enable stack smashing protection support using GCC's
-fstack-protector option family.
See
http://www.linuxfromscratch.org/hints/downloads/files/ssp.txt
for details.
Note that this requires the toolchain to have SSP support.
This is always the case for glibc and eglibc toolchain, but is
optional in uClibc toolchains.
config BR2_SSP_NONE
bool "None"
help
Disable stack-smashing protection.
config BR2_SSP_REGULAR
bool "-fstack-protector"
help
Emit extra code to check for buffer overflows, such as stack
smashing attacks. This is done by adding a guard variable to
functions with vulnerable objects. This includes functions
that call alloca, and functions with buffers larger than 8
bytes. The guards are initialized when a function is entered
and then checked when the function exits. If a guard check
fails, an error message is printed and the program exits.
config BR2_SSP_STRONG
bool "-fstack-protector-strong"
depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_9
help
Like -fstack-protector but includes additional functions to be
protected - those that have local array definitions, or have
references to local frame addresses.
comment "Stack Smashing Protection strong needs a toolchain w/ gcc >= 4.9"
depends on !BR2_TOOLCHAIN_GCC_AT_LEAST_4_9
config BR2_SSP_ALL
bool "-fstack-protector-all"
help
Like -fstack-protector except that all functions are
protected. This option might have a significant performance
impact on the compiled binaries.
endchoice
comment "Stack Smashing Protection needs a toolchain w/ SSP"
depends on !BR2_TOOLCHAIN_HAS_SSP
endmenu
source "toolchain/Config.in"